PaperlayerView exact revision on arXiv

Source-linked AI summary

Mitigating Fabrication in Multi-Stage LLM Pipelines for Hiring: An Empirical Evaluation of Prompt Guardrails and Human-in-the-Loop Checkpoints

Hiroko Takano

arXiv:2608.26171v1cs.CYcs.CLcs.HC

TL;DR

Multi-stage LLM hiring pipelines can propagate fabricated credentials and experience into later interview stages, but evidence on effective safeguards is limited. This paper compares prompt guardrails and human checkpoints in a controlled experiment and finds that both help complementarily, while neither alone reaches deployable safety.

  • Problem

    Multi-stage LLM hiring pipelines can propagate fabricated credentials and experience across resume and interview stages, motivating evidence on effective safeguards.

  • Method

    The study compares automated, prompt-guarded, and human-checkpointed pipelines using finding density, fabrication rates, claim retention, usefulness, and JD-trap capture.

  • Results

    An 86% reduction in fabrication density from prompt guardrails and zero identity fabrications after human review demonstrate complementary mitigation effects.

  • Takeaways & Limitations

    The evidence supports layering low-cost prompt guardrails with human checkpoints because they address different parts of the fabrication distribution.

  • Takeaways & Limitations

    The study evaluates one reviewer, so its removal rates and error profiles may not generalize to human reviewers broadly.

Abstract

from arXiv · show

Multi-stage LLM hiring pipelines (resume improvement, interview question generation, answer feedback) can fabricate credentials, inflate qualifiers, and invent experience. We evaluate two mitigations, prompt guardrails and human-in-the-loop (HITL) checkpoints, against a fully automated baseline. In a controlled experiment (10 synthetic resumes x 2 job descriptions x 3 repetitions x 3 conditions; 180 runs), the baseline (C1) produced at least one unsupported claim in 96.7% of outputs (mean 6.80 findings/output). Prompt guardrails (C2) reduced finding density by 86% (6.80 to 0.92/output), but 50.0% of outputs still contained a fabrication, showing prompt-level mitigation alone is insufficient. A human checkpoint after resume improvement (C3) eliminated all identity fabrications, reduced finding density by 59% (6.88 to 2.82/output), reduced item-level fabrication from 96.7% to 75.0% (p=.022), and cut capture of JD-embedded trap requirements from 47% to 2% (vs. 5% under the guardrail). An exploratory analysis of multi-specialty resumes shows contamination rising monotonically with domain distance between specialties, suggesting career changers are especially exposed. The reviewer in this study caught all flagrant fabrications, but subtle qualifier drops and plausible new claims survived review roughly half the time (54.5% removal). Neither mitigation degraded the deliverable: claim retention exceeded 99% under both. The interventions are complementary: the guardrail eliminates unprompted additions and qualifier inflation cheaply, while the checkpoint gives near-categorical guarantees against the most severe failures, invented identities and JD-baited claims. These results support a layered architecture combining guardrails with a human checkpoint. A supplementary run with a newer-generation model (90.0% baseline fabrication rate) suggests the problem is not resolved by model progress alone.

1 Introduction

The introduction frames multi-stage hiring pipelines as vulnerable to fabrication propagation, including invented identities and cross-specialty contamination. It motivates quantifying prompt guardrails and human checkpoints, including residual errors and reviewer fallibility.

  • Problem: In multi-stage hiring pipelines, an early fabrication can become the factual premise for downstream interview questions and feedback.Each LLM stage consumes the previous stage’s output, allowing unsupported claims to propagate.
  • Motivation: 6 of 60 baseline outputs contained invented identity details despite resumes deliberately omitting names and contact information.Complete fictional name headers also appeared unprompted during the pilot, prompting a protocol update.
  • Motivation: Multi-specialty careers motivate testing whether AI rewriting blends domains, using a controlled specialty-distance gradient and exploratory contamination analysis.Examples include design with data analysis and law with localization.
  • Study contribution: 180 runs compare automated, prompt-guardrail, and human-checkpoint conditions on a privacy-preserving benchmark with claim-level ground truth and fabrication traps.The design targets fabrication rates, residuals, reviewer errors, and newer-generation model effects.
  • Study contribution: 86% lower fabrication density under prompt guardrails still left fabrication in half of outputs, while one human checkpoint removed all identity fabrication and 59% of finding density.The introduction also identifies qualifier drops, plausible additions, and protocol deviations as measurable limits of human review.

2 Related Work

This section situates the study within research on LLM fabrication, error propagation, human oversight, guardrails, evaluation validity, and recruiting NLP. It emphasizes claim-level measurement and a checkpoint intervention as responses to known limitations of automated pipelines and prompt-only controls.

  • Hallucination and fabrication: Resume fabrication is a faithfulness failure with unusually well-defined ground truth, enabling claim-level measurement rather than reference-free estimation.The ground truth consists of the original resume plus an explicit absence list.
  • Error propagation: Errors in multi-agent and multi-stage LLM systems can propagate through dependencies and compound into end-to-end failures exceeding any single component’s error rate.The study measures a checkpoint between generation stages as a specific, deployable intervention point.
  • Human oversight and its limits: Human oversight can become procedural because reviewers miscalibrate trust in fluent automated output, motivating interface interventions that sustain substantive review.Cognitive forcing functions are identified as one way to keep review engaged.
  • Guardrails: Prompt-level guardrails are fragile and generally insufficient as safety controls; in this non-adversarial setting, strict factual rules still left fabrication in half of outputs.The literature describes guardrails as vulnerable to override or noncompliance, while the study quantifies their insufficiency without an attacker.
  • Recruiting NLP: Recruiting NLP already includes deployed LLM pipelines for role-specific resume tailoring, making content preservation a relevant safety property for these tools.ResumeFlow is cited as a representative pipeline that extracts job-description and resume details before generating a tailored resume.

3 Method

The study evaluates fabrication mitigations in a controlled, logged multi-stage hiring pipeline using synthetic resumes, paired job descriptions, three conditions, and ground-truth claim sheets. Fabrication is assessed primarily by finding density, with item-level fabrication and claim retention as secondary measures, alongside documented reviewer and judge protocols.

  • Data and ground truth: 10 synthetic PII-free resumes included controlled variation in occupation, structure, information density, and specialty composition, with four multi-specialty resumes spanning a domain-distance gradient.The gradient enabled measurement of cross-domain contamination, such as graphic-design experience rewritten as UX experience.
  • Data and ground truth: Each resume had a ground-truth claim sheet listing atomic claims and an explicit absence list of plausible-but-absent certifications, tools, domains, and language levels.The absence-list items served as fabrication traps.
  • Data and ground truth: 20 job descriptions paired each resume with a proximate JD at ∼75% requirement overlap and a stretch JD at ∼45%, each embedding one rotating trap requirement.Items intended to measure unprompted fabrication were excluded from all JDs.
  • Experimental conditions: The experiment compared an automated baseline, a strict prompt guardrail, and HITL checkpoints that halted the pipeline for claim-sheet-based correction, with all edits recorded as timestamped diffs and content hashes.C3 used C1 prompts to isolate the human effect; a combined guardrail-plus-HITL condition was deferred.
  • Experimental design: 180 main runs resulted from 10 resumes × 2 JDs × 3 conditions × 3 repetitions, with randomized pair-level order, fixed generation settings, version-controlled prompts, and JSONL logging.A supplementary stage-1 run used claude-fable-5 on 20 pairs with one repetition and default sampling.
  • Evaluation: Finding density was primary, while binary item-level fabrication rate and claim retention were secondary measures of fabrication prevalence and content preservation.Claim retention counted ground-truth claims as retained when their substance remained present, allowing rewording.

4 Results … 4.3 The human checkpoint: large effect, systematic residual (RQ3)

Fabrication was pervasive without safeguards, while prompt guardrails sharply reduced but did not eliminate unsupported claims. A human checkpoint produced a larger reduction and caught flagrant failures, yet subtle qualifier drops and plausible new claims often remained.

  • 4.1 Fabrication is the default behavior (RQ1): 96.7% of baseline outputs contained at least one unsupported claim, averaging 6.80 findings per output.Identity fabrication occurred in 6 outputs; new_unsupported was the largest category, with 237 findings.
  • 4.1 Fabrication is the default behavior (RQ1): 96.7% and 6.88/output under C3_pre replicated the baseline profile, passing the design sanity check.The pair-level difference was 0.0% with p = 1.0.
  • 4.2 Guardrails help substantially but are insufficient (RQ2): 86% lower finding density under C2 reduced 6.80 to 0.92 per output and eliminated identity and qualifier_drop findings.Item-level fabrication fell from 96.7% to 50.0%; residual findings were dominated by new_unsupported claims despite the prohibition on additions.
  • 4.2 Guardrails help substantially but are insufficient (RQ2): 50.0% of guardrail-protected outputs still contained at least one fabrication, so prompt-level mitigation alone did not provide a deployable safety property.The residual was dominated by new_unsupported findings.
  • 4.3 The human checkpoint: large effect, systematic residual (RQ3): 59% lower finding density under C3 reduced 6.88 to 2.82 per output, while item-level fabrication fell from 96.7% to 75.0%.The pair-level sign test was 9/1 with p = .022, based on 60 matched pre/post runs.
  • 4.3 The human checkpoint: large effect, systematic residual (RQ3): Every flagrant fabrication and most trap hits were caught by the reviewer, but subtle qualifier drops and plausible new claims survived roughly half the time.One review introduced a new finding, changing a pre-clean run to post-fab.
  • 4.3 The human checkpoint: large effect, systematic residual (RQ3): Reviewer-support tooling should automate diff highlighting against source claims and qualifier-preservation checks to target residual error classes.These mechanisms address errors that an unaided reviewer may miss after the checkpoint.

4.4 Guardrail vs. checkpoint · 4.5 Newer model, same problem (RQ4) · 4.6 Content preservation and usefulness

Guardrails and checkpoints have complementary strengths: guardrails reduce aggregate fabrication cheaply, while checkpoints provide categorical protection against severe failures. Newer models still fabricate by default, but both mitigations preserve content and usefulness.

  • 4.4 Guardrail vs. checkpoint: C2’s fabrication density was 0.92 versus 2.82 for C3_post, making the guardrail at least as clean on aggregate fabrication metrics.The checkpoint’s case instead rests on categorical identity removal and complementary failure modes.
  • 4.4 Guardrail vs. checkpoint: Identity removal reached 100% under the checkpoint, a categorical guarantee no prompt achieved.C2’s residual failures were plausible additions generated despite guardrails, motivating complementary intervention design.
  • 4.4 Guardrail vs. checkpoint: The combined condition C4 directly tested complementarity between guardrails’ fabrication reduction and checkpoints’ stronger protection against severe failures.The paper frames this complementarity alongside differences in JD alignment and content preservation.
  • 4.5 Newer model, same problem (RQ4): 90.0% item-level fabrication occurred with the newer model, with 4.65 findings per output and new_unsupported dominant at 54/93.Identity fabrication was 0, changing the failure profile without changing the conclusion that unguarded pipelines fabricate by default.
  • 4.6 Content preservation and usefulness: Claim retention remained high across conditions: C1 97.6%, C2 99.2%, C3_post 99.4%, and SUP 99.8%.The guardrail’s low finding counts therefore were not explained by content loss.
  • 4.6 Content preservation and usefulness: Usefulness scores were high everywhere at 4.5–5.0, while C2 and C3_post did not differ significantly: 4.77 versus 4.86, p = .34.The baseline’s jd_alignment advantage over C2, 4.88 versus 4.55, partly reflected fabricated JD-matching qualifications.
  • 4.6 Content preservation and usefulness: Both mitigations preserved the deliverable, with safety gains not purchased through content loss or material usefulness loss.The checkpoint recovered some alignment the guardrail forgoes without the baseline’s fabrication.

4.7 Handling of protocol deviations · 4.8 Induced vs. unprompted fabrication (trap analysis) · 4.9 Cross-domain contamination along the specialty-distance gradient (exploratory)

The primary analysis retained one conservative protocol deviation, while trap analysis showed the checkpoint best resisted JD-baited fabrication and the guardrail uniquely eliminated unprompted absence-list hits. Exploratory evidence further indicated monotonically increasing cross-domain contamination as specialty distance widened.

  • 4.7 Handling of protocol deviations: 1 of 60 C3 runs was unreviewed at the stage-1 checkpoint and retained in the primary analysis, conservatively slightly understating the checkpoint effect.The deviation’s magnitude was considered negligible; two stage-2 deviations affected only question-stage analysis.
  • 4.8 Induced vs. unprompted fabrication (trap analysis): Each job description embedded one absent-from-resume trap requirement, with 19 of 20 traps directly measurable as explicit absence-list items.The remaining language-level trap was outside the absence list by design and excluded from that analysis.
  • 4.8 Induced vs. unprompted fabrication (trap analysis): 1.8% (1/57) trap capture under the checkpoint versus 5.3% under the guardrail made the checkpoint the strongest defense against JD-baited fabrication.The reviewer’s explicit final JD-requirement audit plausibly explains this asymmetry.
  • 4.9 Cross-domain contamination along the specialty-distance gradient (exploratory): Contamination-type alterations increased monotonically with specialty distance across the four paired-specialty resumes, from 12 for near-distance R1 to progressively higher levels.The exploratory pooling used C1 and C3_pre, with 12 outputs per resume; one resume represented each distance level, so no tests were performed.
  • 4.9 Cross-domain contamination along the specialty-distance gradient (exploratory): The outputs visibly fused distant specialties by inventing a hybrid title for R1, re-scoping R3 achievements into technical governance, and rewriting R7 legal practice as localization leadership.R7, the farthest specialty pair, showed the heaviest fusion.
  • 4.9 Cross-domain contamination along the specialty-distance gradient (exploratory): Career changers and multi-specialty professionals therefore appeared especially exposed to fabrication from automated rewriting, although this exploratory pattern lacked statistical testing.The mechanism was visible in the generated outputs, but the design included only one resume per distance level.

5 Discussion

Prompt guardrails and human checkpoints are each insufficient alone but address different parts of the fabrication distribution. Their complementary strengths support a layered architecture in which guardrails reduce review burden and human oversight provides stronger guarantees.

  • Combining the mitigations: 50% of outputs still contained fabrication under the best guardrail, while 75% of reviewed outputs retained at least one finding under a human checkpoint.Neither mitigation alone reached deployable safety.
  • Residual reviewer error: 100% of identity fabrications were removed, compared with roughly 55% for qualifier drops and new claims.The removal gradient indicates that machine assistance for source alignment and qualifier tracking could target the reviewer’s weakest categories.
  • Combining the mitigations: 86% reduction in review burden came from reducing findings from 6.80 to 0.92 per output with guardrails.The reviewer then supplies guarantees that prompting alone did not achieve.
  • Reviewer fallibility: Protocol deviations and one review-introduced finding were retained as data because reviewer behavior and errors are themselves part of the measured oversight phenomenon.The residual-error profile is therefore informative for checkpoint design.

6 Limitations

The study’s limitations constrain generalization across reviewers, models, domains, data realism, and evaluation validity. Quality and checkpoint results should therefore be interpreted as narrow evidence rather than broadly generalizable estimates.

  • Reviewer and checkpoint validity: n = 1 reviewer leaves between-reviewer variance, training effects, and fatigue dynamics unmeasured, limiting claims to checkpoint effects under one protocol.Generalization requires a multi-reviewer study.
  • Reviewer and checkpoint validity: 90% adjudicated accuracy and 93.8% precision/recall were estimated on n = 20 items, with greatest uncertainty at the embellishment boundary.Residual judge error concentrates in the largest new/altered finding category.
  • Reviewer and checkpoint validity: C3_post validity is non-independent because the reviewer also served as the validity verifier for that stratum.This non-independence was disclosed in §3.6.
  • Scope and benchmark: A single generation model and hiring domain, using English-language resumes, limit model and domain generality; the SUP run probes generality only at baseline.The benchmark was synthetic and PII-free, which may understate the messiness of real resumes.
  • Quality measurement: Usefulness scores of 4.5–5.0 and retention of 97–100% show ceiling effects, while the quality judge lacked separate validation against human ratings.These metrics support only the narrow claim of no material content or usefulness loss under either mitigation.
  • Checkpoint design: Two checkpoints were measured jointly at stage 1, while stage-2 question-checkpoint effects were analyzed separately.The design therefore does not provide a single combined estimate for both checkpoint stages.

7 Future Work

Future work will test the combined guardrail-plus-HITL condition, examine reviewer support and downstream propagation, and confirm cross-domain contamination with a larger controlled study.

  • C4 will evaluate a combined guardrail-plus-HITL condition in 60 runs.
  • A multi-reviewer replication will compare tooling-assisted with unaided review and analyze propagation through question generation and feedback stages.
  • A confirmatory cross-domain contamination study will use multiple resumes per distance level to extend the exploratory gradient result.

8 Conclusion

In a controlled 180-run comparison, fully automated resume-improvement pipelines fabricated in 96.7% of outputs. Prompt guardrails and a single human checkpoint mitigated fabrication in complementary ways without sacrificing content or usefulness.

  • Overall findings: 96.7% of outputs from fully automated resume-improvement pipelines contained fabrication across the controlled 180-run comparison.The comparison evaluated fully automated pipelines against two mitigation strategies.
  • Complementary mitigations: 86%: prompt guardrails reduced fabrication density and eliminated unprompted additions entirely.Guardrails addressed fabrication cheaply at the prompting stage.
  • Complementary mitigations: 100%: a single human checkpoint eliminated identity-level fabrication.The checkpoint provided the strongest protection against invented identities.
  • Complementary mitigations: 1.8%: the human checkpoint reduced capture of JD-baited trap requirements, while cutting fabrication density by 59%.The checkpoint targeted severe failures involving job-description-embedded traps.
  • Practical implication: Neither intervention sacrificed content or usefulness.The results support combining automated guardrails with human review in hiring pipelines.

Ethics statement

The study used fully synthetic, PII-free resumes and job descriptions, excluded real candidates’ data, and did not reproduce generated fabricated identity details.

  • Ethics statement: All resumes and job descriptions were fully synthetic and PII-free, with no real candidates’ data used.The paper also omits any fabricated identity details generated during the experiment.
Loading 2608.26171v1…